Earlier quoted context omitted.
> I asked Codex to mash up Super Mario Bros and Contra ROMs Did this create a new game? And did you publish the result? Might’ve misunderstood.
No, of course I didn't publish it.
Of course not.
Codex Security
241–250 of 257 posts
Re: Codex Security
#242Earlier quoted context omitted.
Have it run fuzz and test suites. Get with it man. Most of my LLM projects have massive test suites that do a far better job then I ever would have.
Did you look at those test suites? Sometimes they test nothing.
Yes, but not all - it has been a long time in my experience that frontier LLMs have written nonsense tests.
Re: Codex Security
#243Earlier quoted context omitted.
comment feels like someone complaining about being offered a fireproofing solution in the age of flamethrowers.
That’s exactly what they’re saying. With the added (and very important) detail that the people selling the fireproofing are the the same who armed everyone with flamethrowers. Why shouldn’t someone complain about that?
Cos in this case the flameproofing is made out of fire too. It's the same product either way. If you like you can just not buy it and suffer, or they could not sell it and deepseek or some other model gets there eventually.
Its not a good point, its whining about change and service providers offering change.
Re: Codex Security
#244Hey HN, Michael here, co-founder of Promptfoo and one of the people working on the Codex Security CLI at OpenAI. Thanks for checking this out and for flagging the auth issues. We just open-sourced it, and there's still plenty for us to improve. Expect the product to evolve quickly. If you try it, I'd really appreciate hearing what works well and what you think we should improve. Happy to answer questions here. CLI do…
Can we build a different app experience on this open-source tool? Does the license permit
Re: Codex Security
#245Earlier quoted context omitted.
If you didn't already know, jobs at highly competitive companies tend to have vague job requirements because they expect to be able to apply your raw intelligence to changing demands quickly. There's no point being hyper-specific about the exact software packages because that's not what they want. What they want is someone who, after talking to an interviewer for 30 minutes, leaves them with the thought "Wow, this pe…
> raw intelligence I'm not sure how this would apply. Are you implying that if the company operates on Python, you can hire someone with great "raw intelligence" who have only developed C++ all their life, and they can start contributing on day 1? You need to clearly list what the position entails, otherwise you're wasting time.
> I'm not sure how this would apply. Are you implying that if the company operates on Python, you can hire someone with great "raw intelligence" who have only developed C++ all their life, and they can start contributing on day 1?
In your particular case, no not on day 1. But they can probably make meaningful contributions after 2 weeks. They'll pick it up quick because they're some of the best talent on the market.
Re: Codex Security
#246Earlier quoted context omitted.
If you didn't already know, jobs at highly competitive companies tend to have vague job requirements because they expect to be able to apply your raw intelligence to changing demands quickly. There's no point being hyper-specific about the exact software packages because that's not what they want. What they want is someone who, after talking to an interviewer for 30 minutes, leaves them with the thought "Wow, this pe…
> There's no point being hyper-specific about the exact software packages because that's not what they want Okay. This makes it sound like they're more sophisticated but it seems more like they are less sophisticated, less specific, and a lot more vague in the job descriptions they themselves create. If you look at any technical role, game dev or something where people are building important things at scale - there a…
> I'm just wondering. It's OpenAI. Surely there is some domain-specific something beyond "has experience shipping front-end and back-end services" since that includes basically everyone.
Maybe you're looking at this from your own particular point of view too much. I work in systems software, as do many others on HN: our demographic wouldn't be qualified for that at all.
Re: Codex Security
#247Earlier quoted context omitted.
Is that so? I feel like I’m seeing more Python and TypeScript than ever, especially when it comes to AI tooling, which is disappointing. I can’t fathom why anybody would want to continue working with dynamically typed languages when they can now get types for free.
In the early days of LLM coding, it seemed to be much better at Python for whatever reason. I was never a big Python guy, but I got better results so I ran with it. That definitely doesn't seem to be the case anymore. Last week I asked Codex to mash up Super Mario Bros and Contra ROMs and it just did everything in straight assembly and absolutely crushed it. It couldn't do that 2 years ago. Python is just momentum an…
What does mashing up roms mean? Like use sprites of one game in another or something like that?
Re: Codex Security
#248Quick tangent if you’re willing to humor me… I've been noticing that many new projects that would have been written in Python or Node a year ago are starting to be written in Go, Rust, etc. Theory: people realized there’s little benefit to Python for agents. As Zep wrote, an “agent is a long-running, concurrent, I/O-bound process that spends most of its time waiting on a model, a tool, or a human[1]” — not a particul…
Go really feels like it was build for agentic development. Surprised it's not more popular than Rust.
Re: Codex Security
#249Earlier quoted context omitted.
Thanks! You've run into a real limitation: the CLI doesn't bypass the model's cybersecurity guardrails. If GPT-5.6 Sol finds a vulnerability but refuses to explain it, switching from the Codex app to the CLI won't automatically fix that. For authorized defensive work, Trusted Access for Cyber (TAC1/Daybreak) can reduce refusals depending on the model and the account or organization where access is provisioned. It isn…
> If you're an open-source maintainer, you can apply for conditional Codex Security access here: > https://openai.com/form/codex-for-oss/ Hey, Lead maintainer of vim here. Applied twice already never heard anything back. This is a frustrating experience!
Please email me and I will help fix this.
Re: Codex Security
#250Earlier quoted context omitted.
Thanks! You've run into a real limitation: the CLI doesn't bypass the model's cybersecurity guardrails. If GPT-5.6 Sol finds a vulnerability but refuses to explain it, switching from the Codex app to the CLI won't automatically fix that. For authorized defensive work, Trusted Access for Cyber (TAC1/Daybreak) can reduce refusals depending on the model and the account or organization where access is provisioned. It isn…
>> For authorized defensive work, Trusted Access for Cyber (TAC1/Daybreak) can reduce refusals Or perhaps a better option is to use something like Kimi K3 and cancel the GPT subscription altogether.
[dead]